Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have recently set up a Terminal Services Gateway website to allow external access to a Remote Desktop server. Each user installs a client certificate on their personal computer, connects to the HTTPS TS Gateway site, logs in, then connects to the configured remote desktop machine.

All users have the same access rights and configurations on the server side, and all certificates are issued from our local CA; the certificate chain is also installed on their local PCs.

Out of 30 users, two specific users are unable to use the system. They connect to the TS Gateway site using their client certificate, can log into the the TS site using their user accounts, and can then click on the configured remote desktop machine. They are prompted for login username and password, then see a "Connecting" dialog. After a while, they receive the message:

The computer can't connect to the remote computer. 
The two computers couldn't connect in the amount of time allotted.

We've checked everything we know how to, even silly items that shouldn't be related: they are using the same Windows XP SP3 as several other users, their Windows Firewall is enabled with port 443 open, each of them is using the same internet service provider and plan as another user who is connecting successfully, it still happens even after trying to issue a new certificate, and their system clocks are synchronized to the same public NTP source as the server they are connecting to.

Unfortunately, diagnosis is difficult since we don't have direct access to their home machines to try for ourselves.

What else should we check?

share|improve this question

Try troubleshooting with their system hooked directly to their high speed modems (cable, DSL, etc.) to isolate any possibilities of their home NAT routers playing any part in the difficulties. Some "ping" samples may also reveal any network performance issues as well.

share|improve this answer
Good idea, I'll check out that possibility. – ryandenki Aug 9 '11 at 6:26
If it comes down the to NAT routers, watch out for the various implementations of SPI. Different implementations/interpretations can cause all sorts of difficulties depending on the network application. – user48838 Aug 9 '11 at 7:34
Yes, I'm a little worried about that. We have another user whose session is cut off every few minutes because of some kind of connection timeout filtering rule his ISP has in place. Thanks for the idea. – ryandenki Aug 9 '11 at 8:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.